django.git/django/db/models/sql, branch stable/6.0.x

[6.0.x] Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods.

2026-02-03T13:05:34Z

This prevents failures at the database layer, given that aliases in the ON clause are not quoted. Systematically quoting aliases even in FilteredRelation is tracked in https://code.djangoproject.com/ticket/36795. Backport of 005d60d97c4dfb117503bdb6f2facfcaf9315d84 from main.

[6.0.x] Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via aliases with periods.

2026-02-03T13:04:49Z

Before, `order_by()` treated a period in a field name as a sign that it was requested via `.extra(order_by=...)` and thus should be passed through as raw table and column names, even if `extra()` was not used. Since periods are permitted in aliases, this meant user-controlled aliases could force the `order_by()` clause to resolve to a raw table and column pair instead of the actual target field for the alias. In practice, only `FilteredRelation` was affected, as the other expressions we tested, e.g. `F`, aggressively optimize away the ordering expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY "table".column. Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard for reviews. Backport of 69065ca869b0970dff8fdd8fafb390bf8b3bf222 from main.

[6.0.x] Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

2026-02-03T13:03:39Z

Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews. Backport of e891a84c7ef9962bfcc3b4685690219542f86a22 from main.

[6.0.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:17:15Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.

[6.0.x] Fixed #35453 -- Made ManyToManyField.concrete False.

2025-09-23T01:52:21Z

ManyToManyField was already excluded from fields, concrete_fields, and local_concrete_fields in Options. Backport of f9a44cc0fac653f8e0c2ab1cdfb12b2cc5c63fc2 from main

Refs #27222 -- Refreshed GeneratedFields values on save() initiated update.

2025-09-13T22:27:49Z

This required implementing UPDATE RETURNING machinery that heavily borrows from the INSERT one.

Fixed #36481 -- Fixed QuerySet.update concrete fields check.

2025-09-04T16:15:45Z

FieldError is now emitted for invalid update calls involving reverse relations, where previously they failed with AttributeError.

Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.

2025-09-03T11:10:58Z

Thanks Eyal Gabay (EyalSec) for the report.

Fixed #36431 -- Returned tuples for multi-column ForeignObject in values()/values_list().

2025-08-29T19:33:44Z

Thanks Jacob Walls and Simon Charette for tests. Signed-off-by: SaJH

Refs #36152 -- Suppressed duplicate warning when using "%" in alias via values().

2025-08-29T17:45:08Z